CVE-2026-110127
MediumCVSS 4.3Summary
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController. Authenticated members can modify or delete other members' cart items by enumerating sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
Risk Assessment
Attackers can alter quantities, selection state, or remove items from other users' carts, potentially disrupting orders and causing customer dissatisfaction.
Recommendation
Add cart ownership verification in modification and deletion operations so users can only affect their own carts, and prevent identifier enumeration.
Other vulnerabilities in waynboot-mall
See all- CVE-2026-110126Medium
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in AddressController. Authenticated members can modify or delete other members' shipping addresses by enumerating auto-increment address ids and sending POST /address or DELETE /address/{addressId} requests.
- CVE-2026-110125Medium
Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by supplying their order identifiers. Attackers can enumerate sequential order ids or serial numbers via detail, cancel, confirm, delete and refund endpoints to read recipient addresses and phone numbers or disrupt orders.
Original NVD description (English source)
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS